This is a translation. The German version is legally binding.
In short: Without an account this site writes nothing about you to disk: games and guest progress live only in the server's memory and are forgotten soon after they end. An account is optional and only stores a name, a password hash and the results of your games – and, if you play correspondence games, those games with their moves while they run and until 30 days after they end. No ads, no tracking, no analytics, no fonts or scripts from other servers. Below is every single piece of data that comes up here.
Müller & Wulff GmbH
Hans-Fallada-Str. 20
D – 17489 Greifswald
Email: info@mueller-wulff.de
This is the complete list. Anything not listed here is not stored (for the server's error messages see “Hosting and server”).
A random string, nothing else. Only set once you start or open a game.
de or en – only if you switch the language at the bottom of the page.
Your last chosen settings (opponent, strength, colour, time control), whether the board is shown in 3D
or flat, whether the help is on and which colour scheme you like – in localStorage under
schach:einstellungen, schach:ansicht, schach:hilfen, schach:farbe and
schach:modus.
Token, game mode, computer strength, time control, all moves, the clock times and the outcome; per side the hints and take-backs used, the worst material deficit and special events like “captured en passant”. For each side of the board a SHA-256 hash of the cookie of the browser sitting there (for correspondence games the account instead, see below). For every open connection – spectators included –: account name (if signed in), page language and the browser's time zone.
Per finished game: kind of opponent (computer level, “live” or correspondence – not who it was), your colour, result, reason, what gave mate, number of moves, duration, time control, your time left on the clock, whether play went on without a clock after a timeout, how often hint or take-back was used, your worst material deficit, a few special events (e.g. “captured en passant”), the time and your browser's time zone. Plus which badges you have and since when.
In live games with a running clock: whether a player has just left the page (other tab, other window, connection lost), how often and for how long in total. Your browser only reports “away” or “back” – nothing about what you do elsewhere.
While the game page is open there is a WebSocket connection to the server.
Name, password as a hash, date created.
The same as “Progress as a guest” above. Not stored: the moves of the game and who your opponent was – except for correspondence games, see there.
Only if you play correspondence games: token, the account names of both players, all moves, when the game was created, started, last moved and ended, open draw and rematch offers and the result. They are kept in a file of their own next to the accounts.
A hash of the cookie id, which account it belongs to, and an expiry date.
Without an account: nothing. There is no database; accounts are kept in one file on the server, correspondence games in a second.
Anyone who knows the link or the token of a game. Once both seats are taken, someone with the link can only watch – the players see how many are watching. Visible are the board, the moves, the clocks, whether the players are connected and whether they have left the page (see above); for correspondence games also the account names of both players. The token is 10 random characters; it practically can't be guessed. Game pages are blocked for search engines.
You copy the link and the token and pass them on yourself. Where you paste them is up to you – the rules of the service you choose then apply.
No email addresses, no real names (unless you pick yours as user name), no moves of past games (except correspondence games, see above), no IP addresses – neither by the app nor by the web server –, no device fingerprint, no clicks, no referrers, no statistics about your behaviour. There is no profiling and no automated decision-making about you (Art. 22 GDPR).
Consent (and with it a cookie banner) is only needed for things a site stores on your device although they aren't strictly necessary for the actual service – for ads, tracking or statistics, say. This site doesn't do that. The two cookies and the settings in your browser are strictly necessary for the game you came for, or to keep the language and settings you explicitly chose (§ 25 (2) no. 2 TDDDG).
The site runs at: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Deutschland (eigener Root-Server im Rechenzentrum Nürnberg).
To deliver a web page at all, our server has to process your IP address briefly. Neither the app nor the web server keeps access logs. On technical errors they log an error message with the requested address (which may contain a game's token), but without IP address and without details about your browser; these messages are kept only in limited amounts and then overwritten automatically. The legal basis is our legitimate interest in secure and working operation (Art. 6 (1) (f) GDPR).
We don't pass on any data. What other players and spectators of a game see is described above under “Who can see a game”. The hosting provider only runs the data centre and the hardware our server runs on; in doing so it may technically come into contact with connection data, for example to fend off attacks. All data stays in Germany; nothing is transferred to countries outside the EU.
You don't have to provide any data: you can play against the computer and live without an account. Without the “schach” cookie you can't take a seat in a game, though, and without an account there are no correspondence games and your results aren't kept permanently.
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Most of it you can do yourself right away:
Right to object (Art. 21 GDPR): where we rely on legitimate interests (the server's error messages, “leaving the page”), you can object at any time on grounds relating to your particular situation – an email is enough.
You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example: Der Landesbeauftragte für Datenschutz und Informationsfreiheit Mecklenburg-Vorpommern, Werderstraße 74a, 19055 Schwerin.
Signs you out and deletes the cookies, your guest progress and the settings in this browser. Afterwards you can no longer enter running games as a player – they disappear from the server on their own. An account stays; to delete it, see above.
Last updated: Oktober 2026